Two authorization bypasses in n8n’s AI agents let low-privileged users perform actions beyond those allowed by their role, including executing arbitrary nodes and exfiltrating credentials in cleartext. In some configurations, the same attack path can also…

Nicolas Krassas says his group killed its AI security startup idea and released OpenHunterAI, a source-available red-team engine for web, API and LLM apps.

Search and explore cloud infrastructure vulnerabilities with real-time severity filtering and CVSS scoring.

The UaniaBOX hands its admin a web GUI and no shell. Its packet capture page validated the one field that looked dangerous, then handed me arbitrary file...

Two ways out. One lets a patch write anywhere on the disk with no prompt. The other gets unsandboxed command execution out of read-only, the strictest mode Codex has.

Frappe LMS is an open-source learning management system built on the Frappe framework. It provides organizations with tools to create and manage online courses, track student progress, post job opportunities, and run learning batches.

Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…

strict-origin-when-cross-origin: A Referer CSRF Bypass

How a missed x86 TLB shootdown became page-table control in Google kernelCTF.

Hunt.io SpiceRAT detections identified shared infrastructure artifacts across malware families in Bitdefender’s SilkParasite report, connecting servers to Central Asian energy, government, and telecom targets.

This is a practical guide to assessing the security of an agentic AI system.

TLDR: Exploit. This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel…

The most powerful, simple and trusted way to gather experience data. Start your journey to experience management and try a free account today.

How a critical Visual Studio Code vulnerability allows unverified extensions to run automatically, and learn how to secure your workstation.

PhantomFix (CVE-2026-90999) is a critical vulnerability in Sentry Seer's autonomous autofix: a fabricated error report sent to a public DSN can reach the coding agent and lead to code execution and access to connected repositories. It's a concrete instance…

10 Lessons From an Invisible Conflict

There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.

A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories